Smoothwall Express versions before 3.1 Update 13 suffer from a reflected cross‑site scripting flaw in the /redirect.cgi, where the url parameter is not properly sanitized. This flaw allows attackers to embed malicious javascript: schemes into the link which, when a user clicks the link, execute arbitrary JavaScript in the victim’s browser, potentially compromising user sessions and confidential data. The weakness is identified as CWE‑79.

All Smoothwall Express deployments running any version before the 3.1 Update 13 release are vulnerable, including updates 1 through 12 of the 3.1 release line. The vulnerability does not affect later updates beyond 3.1 Update 13 or subsequent major releases.

The CVSS score of 5.1 indicates medium severity. The EPSS score of less than 1% suggests the likelihood of exploitation on any given day is low, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers can craft malicious links without authentication, so the primary attack vector is via browser exploitation when users click crafted URLs.